GMP and Annex 11
Isolate systems that can no longer be updated
The EU rules for good manufacturing practice, GMP, set requirements for computerised systems in pharmaceutical manufacturing. The requirements are in Annex 11. A new draft requires, among other things, that systems which cannot be updated are isolated. That is what XoT does.
Annex 11
The current text and a new draft
Annex 11 of the EU GMP guidelines covers computerised systems. The text that applies today is from 2011.
The European Commission, EMA and PIC/S published a completely new draft in July 2025. The draft was out for consultation until October 2025. The final text is expected at the end of 2026 at the earliest, followed by a transition period.
The draft may change before it is adopted. We still use it, because it shows where the requirements are heading. Two new chapters concern XoT directly: one on identity and access and one on security.
The 2025 draft
The draft requirements XoT helps with
The table shows the draft requirements that concern access, networks and logging. The last column shows whether XoT helps. The rows where XoT helps are highlighted in green.
| Section | Requirement | XoT |
|---|---|---|
| 11.1 | Personal accounts, no shared accounts | Partly |
| 11.2 | Access is granted and revoked in time | Yes |
| 11.3 | Users are identified with a high degree of certainty | Yes |
| 11.6 | Multi-factor authentication for remote access to critical systems | Yes |
| 11.8 | Logout after a period of inactivity | Partly |
| 11.9 | A searchable log of logins | Yes |
| 11.10 | Least privilege and segregation of duties | Yes |
| 11.11 | Periodic review of access rights | Partly |
| 15.8 | Segmented networks and strict firewall rules | Yes |
| 15.9 | Periodic review of firewall rules | Partly |
| 15.12 | Isolate systems on unsupported platforms | Yes |
| 15.14 | Isolate systems that have not been patched in time | Yes |
| 15.20 | An encrypted protocol for remote connections over the internet | Yes |
| 12 | Audit trail for changes to GMP data | No |
| 15.18 | Anti-virus protection | No |
The numbers refer to the draft and may change in the final text. The descriptions of the requirements are our simplifications.
Requirement by requirement
How XoT helps
Isolate what cannot be updated – 15.12 and 15.14
Many production systems run on platforms the vendor no longer supports. The draft says such systems must be isolated. The Lock makes the system invisible to anyone without authorisation. The system keeps its address, and the network does not need to be rebuilt. Authorised users can still reach it, but only through the Lock.
Remote access – 11.6 and 15.20
Vendors and engineers who connect from outside sign in with certificates and multi-factor authentication. The connection is encrypted with WireGuard. No VPN into the network is needed.
Access rights – 11.2, 11.10 and 11.11
Every policy applies to a specific person, specific equipment and a specific time. Access can be revoked immediately. The Policy Graph shows who can reach what. That makes the review easy, but the review itself is your responsibility.
Log and sessions – 11.8 and 11.9
The XMS logs every connection with who, what and when. The log is searchable and can be sent to your SIEM. An administrator can set how long a session may last. Otherwise the session ends when the ticket expires. Logout on inactivity in the GMP system itself is handled in that system.
Personal accounts – 11.1
Every person and every device has its own identity in XoT. You manage the accounts in the GMP system itself there.
The 2011 text
Annex 11 as it applies today
Until the draft is adopted, the 2011 text applies. The table shows the sections XoT helps with.
| Section | Requirement | XoT |
|---|---|---|
| 12.1 | Physical or logical controls restrict access to authorised persons | Yes |
| 12.2 | Security is adapted to how critical the system is | Yes |
| 12.3 | Creation, change and removal of access rights are recorded | Yes |
| 3 | Suppliers and service providers | Partly |
| 7.1 | Data is secured by both physical and electronic means | Partly |
| 16 | Business continuity | Partly |
| 9 | Audit trail for changes to GMP data | No |
| 14 | Electronic signatures | No |
Data integrity
Logs that stand up to an inspection
GMP is built on data integrity. Data must be traceable to a person and a point in time. It must not be changed afterwards without it being visible.
That applies to access control too. The audit log in the XMS shows every change to policies and access rights. It shows who made the change, when and what was changed. The log is protected against later changes.
The event log shows every connection. Browser sessions are recorded automatically, so you can see what a vendor did. You set how long logs are kept in the XMS. For long-term storage, send them to your SIEM, for example Splunk, IBM QRadar or Wazuh.
XoT does not replace the audit trail in your GMP systems. That trail records changes to data in the system. XoT records who was allowed to reach the system.
Supplier and qualification
Material for assessing us as a supplier
XoT does not create or store GMP data. XoT is infrastructure that protects your systems. So you qualify XoT as part of the infrastructure. You do not validate it as a GMP system.
When you assess us as a supplier, the following is available on request:
- Quality at Xertified, our description of how we work with quality
- a software bill of materials (SBOM)
- penetration test reports
- a description of logs and telemetry in the XMS
The software gets one long-term release every year. That makes it easier to plan changes and requalification.
Common questions
Is XoT validated for GMP?
No. Validation applies to a system in its environment, and you carry it out. XoT can be part of a validated environment as part of the infrastructure.
Does the new draft apply already?
No. The 2011 text applies until the draft is adopted. The draft still shows what inspectors will ask about.
Can vendors still provide remote support?
Yes. The vendor only reaches their own machine, for as long as the policy applies. The connection is logged, and a browser session is recorded.
Do you have experience in life science?
Yes. We have written a report together with Cytiva Testa Center in Uppsala. It is a test facility where companies can try scaling up biological processes.
This is our interpretation of Annex 11 and the draft. It is not a validation.
Ask for qualification material
We are happy to send the material you need to assess us as a supplier.